All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\). **Note:** This is only exploitable in the case of a developer, putting the offending value in a server side configuration file.
CVSS Details
- CVSS 3.1 Base Score: 3.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-python-configobj | Aug 9, 2023 | Apr 3, 2023 | |
| Debian | no-fix-debian-deb-package | May 15, 2025 | Apr 3, 2023 | |
| Freebsd | freebsd-upgrade-package-py39-configobjfreebsd-upgrade-package-py38-configobjfreebsd-upgrade-package-py310-configobjfreebsd-upgrade-package-py311-configobj | Apr 14, 2023 | Apr 9, 2023 | |
| Huawei Euleros 2_0_sp10 | huawei-euleros-2_0_sp10-upgrade-python3-configobj | Jan 10, 2024 | Apr 3, 2023 | |
| Huawei Euleros 2_0_sp11 | huawei-euleros-2_0_sp11-upgrade-python3-configobj | Feb 11, 2025 | Apr 3, 2023 | |
| Huawei Euleros 2_0_sp12 | huawei-euleros-2_0_sp12-upgrade-python3-configobj | Feb 11, 2025 | Apr 3, 2023 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-python-configobj | Feb 12, 2024 | Apr 3, 2023 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-python2-configobjhuawei-euleros-2_0_sp8-upgrade-python3-configobj | Mar 13, 2024 | Apr 3, 2023 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-python3-configobj | Apr 9, 2024 | Apr 3, 2023 | |
| Redhat_linux | no-fix-redhat-rpm-package | Jul 9, 2025 | Apr 3, 2023 | |
| Suse | — | suse-upgrade-python-configobjsuse-upgrade-python3-configobj | Aug 23, 2023 | Apr 3, 2023 |
| Ubuntu | ubuntu-pro-upgrade-python-configobjubuntu-pro-upgrade-python3-configobjubuntu-upgrade-python3-configobj | Sep 27, 2024 | Apr 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub